Microsoft Microsoft Certifications AZ-204 Questions & Answers

• Question 381:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You are developing a medical records document management website. The website is used to store scanned copies of patient intake forms.

  If the stored intake forms are downloaded from storage by a third party, the contents of the forms must not be compromised.

  You need to store the intake forms according to the requirements.

  Solution: Store the intake forms as Azure Key Vault secrets.

  Does the solution meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead use an Azure Key vault and public key encryption. Store the encrypted from in Azure Storage Blob storage.

• Question 382:

  You provide an Azure API Management managed web service to clients. The back-end web service implements HTTP Strict Transport Security (HSTS).

  Every request to the backend service must include a valid HTTP authorization header.

  You need to configure the Azure API Management instance with an authentication policy.

  Which two policies can you use? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. Basic Authentication

  B. Digest Authentication

  C. Certificate Authentication

  D. OAuth Client Credential Grant

  Correct Answer: CD

• Question 383:

  You have an application that includes an Azure Web app and several Azure Function apps. Application secrets including connection strings and certificates are stored in Azure Key Vault.

  Secrets must not be stored in the application or application runtime environment. Changes to Azure Active Directory (Azure AD) must be minimized.

  You need to design the approach to loading application secrets.

  What should you do?

  A. Create a single user-assigned Managed Identity with permission to access Key Vault and configure each App Service to use that Managed Identity.

  B. Create a single Azure AD Service Principal with permission to access Key Vault and use a client secret from within the App Services to access Key Vault.

  C. Create a system assigned Managed Identity in each App Service with permission to access Key Vault.

  D. Create an Azure AD Service Principal with Permissions to access Key Vault for each App Service and use a certificate from within the App Services to access Key Vault.

  Correct Answer: C

  Use Key Vault references for App Service and Azure Functions. Key Vault references currently only support system-assigned managed identities. User-assigned identities cannot be used.

  Reference: https://docs.microsoft.com/en-us/azure/app-service/app-service-key-vault-references

• Question 384:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You are developing a medical records document management website. The website is used to store scanned copies of patient intake forms.

  If the stored intake forms are downloaded from storage by a third party, the contents of the forms must not be compromised.

  You need to store the intake forms according to the requirements.

  Solution:

  1.

  Create an Azure Key Vault key named skey.

  2.

  Encrypt the intake forms using the public key portion of skey.

  3.

  Store the encrypted data in Azure Blob storage. Does the solution meet the goal?

  A. Yes

  B. No

  Correct Answer: A

• Question 385:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You are developing an Azure solution to collect point-of-sale (POS) device data from 2,000 stores located throughout the world. A single device can produce 2 megabytes (MB) of data every 24 hours. Each store location has one to five

  devices that send data.

  You must store the device data in Azure Blob storage. Device data must be correlated based on a device identifier. Additional stores are expected to open in the future.

  You need to implement a solution to receive the device data.

  Solution: Provision an Azure Event Grid. Configure the machine identifier as the partition key and enable capture.

  Does the solution meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  Reference: https://docs.microsoft.com/en-us/azure/event-grid/compare-messaging-services

• Question 386:

  You are developing an Azure Function App that processes images that are uploaded to an Azure Blob container.

  Images must be processed as quickly as possible after they are uploaded, and the solution must minimize latency. You create code to process images when the Function App is triggered.

  You need to configure the Function App.

  What should you do?

  A. Use an App Service plan. Configure the Function App to use an Azure Blob Storage input trigger.

  B. Use a Consumption plan. Configure the Function App to use an Azure Blob Storage trigger.

  C. Use a Consumption plan. Configure the Function App to use a Timer trigger.

  D. Use an App Service plan. Configure the Function App to use an Azure Blob Storage trigger.

  E. Use a Consumption plan. Configure the Function App to use an Azure Blob Storage input trigger.

  Correct Answer: B

  The Blob storage trigger starts a function when a new or updated blob is detected. The blob contents are provided as input to the function. The Consumption plan limits a function app on one virtual machine (VM) to 1.5 GB of memory.

  Reference: https://docs.microsoft.com/en-us/azure/azure-functions/functions-bindings-storage-blob-trigger

• Question 387:

  You are preparing to deploy a website to an Azure Web App from a GitHub repository. The website includes static content generated by a script.

  You plan to use the Azure Web App continuous deployment feature.

  You need to run the static generation script before the website starts serving traffic.

  What are two possible ways to achieve this goal? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. Add the path to the static content generation tool to WEBSITE_RUN_FROM_PACKAGE setting in the host.json file.

  B. Add a PreBuild target in the websites csproj project file that runs the static content generation script.

  C. Create a file named run.cmd in the folder /run that calls a script which generates the static content and deploys the website.

  D. Create a file named .deployment in the root of the repository that calls a script which generates the static content and deploys the website.

  Correct Answer: AD

  A: In Azure, you can run your functions directly from a deployment package file in your function app. The other option is to deploy your files in the d:\home\site\wwwroot directory of your function app (see A above). To enable your function app to run from a package, you just add a WEBSITE_RUN_FROM_PACKAGE setting to your function app settings.

  Note: The host.json metadata file contains global configuration options that affect all functions for a function app.

  D: To customize your deployment, include a .deployment file in the repository root. You just need to add a file to the root of your repository with the name .deployment and the content:

  [config]

  command = YOUR COMMAND TO RUN FOR DEPLOYMENT

  this command can be just running a script (batch file) that has all that is required for your deployment, like copying files from the repository to the web root directory for example.

  Reference:

  https://github.com/projectkudu/kudu/wiki/Custom-Deployment-Script

  https://docs.microsoft.com/bs-latn-ba/azure/azure-functions/run-functions-from-deployment-package

• Question 388:

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You are developing an Azure Service application that processes queue data when it receives a message from a mobile application. Messages may not be sent to the service consistently. You have the following requirements:

  1.

  Queue size must not grow larger than 80 gigabytes (GB).

  2.

  Use first-in-first-out (FIFO) ordering of messages.

  3.

  Minimize Azure costs.

  You need to implement the messaging solution.

  Solution: Use the .Net API to add a message to an Azure Storage Queue from the mobile application. Create an Azure Function App that uses an Azure Storage Queue trigger.

  Does the solution meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Create an Azure Function App that uses an Azure Service Bus Queue trigger.

  Reference: https://docs.microsoft.com/en-us/azure/azure-functions/functions-create-storage-queue-triggered-function

• Question 389:

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You are developing a website that will run as an Azure Web App. Users will authenticate by using their Azure Active Directory (Azure AD) credentials.

  You plan to assign users one of the following permission levels for the website: admin, normal, and reader. A user's Azure AD group membership must be used to determine the permission level.

  You need to configure authorization.

  Solution:

  1.

  Create a new Azure AD application. In the application's manifest, define application roles that match the required permission levels for the application.

  2.

  Assign the appropriate Azure AD group to each role. In the website, use the value of the roles claim from the JWT for the user to determine permissions. Does the solution meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  To configure Manifest to include Group Claims in Auth Token

  1.

  Go to Azure Active Directory to configure the Manifest. Click on Azure Active Directory, and go to App registrations to find your application:

  2.

  Click on your application (or search for it if you have a lot of apps) and edit the Manifest by clicking on it.

  3.

  Locate the “groupMembershipClaims” setting. Set its value to either “SecurityGroup” or “All”. To help you decide which:

  1.

  “SecurityGroup” - groups claim will contain the identifiers of all security groups of which the user is a member.

  2.

  “All” - groups claim will contain the identifiers of all security groups and all distribution lists of which the user is a member

  Now your application will include group claims in your manifest and you can use this fact in your code.

  Reference:

  https://blogs.msdn.microsoft.com/waws/2017/03/13/azure-app-service-authentication-aad-groups/

• Question 390:

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You are developing a website that will run as an Azure Web App. Users will authenticate by using their Azure Active Directory (Azure AD) credentials.

  You plan to assign users one of the following permission levels for the website: admin, normal, and reader. A user's Azure AD group membership must be used to determine the permission level.

  You need to configure authorization.

  Solution: Configure the Azure Web App for the website to allow only authenticated requests and require Azure AD log on.

  Does the solution meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead in the Azure AD application's manifest, set value of the groupMembershipClaims option to All.

  Reference: https://blogs.msdn.microsoft.com/waws/2017/03/13/azure-app-service-authentication-aad-groups/